The most robust authentication systems combine multiple biometric mechanisms with an identification card and a password, with all authentication information transferred securely (see the end of the “ Why are passwords weak?” entry, where I talk about using public-key encryption). Other “what you are” mechanisms use fingerprints, retina scans, and voice or handwriting analysis - collectively, biometric mechanisms.
These combine what you have (the ATM card) and what you know (your PIN).Īnother “what you have” mechanism is the SecurID device, which gives you a generated code that you can only get if you have the device with you. These are a combination of what you have (the credit card) and what you are (your signature). Point-of-sale credit-card purchases, where you sign the credit slip.
The most well-known combinations in everyday life are these: And so here, I’ll talk about the others, which can help fix some of the deficiencies of passwords, especially when used in combinations.
What you are.All of the “what you know” mechanisms are variations on userid/password combinations, and they all share the weaknesses that I talked about last August in the referenced post. We broadly divide what authentication mechanisms use into three categories: When you log into webmail, Flickr, MySpace, online banking, or online access to your credit card account, you use this mechanism, which makes use of what you know. It served us well over the years, but it’s not a very robust system, for a number of reasons that I talked about here. It should be obvious, for instance, why authentication is related to authorization and access control.Įveryone reading this is familiar with the authentication mechanism we started out with: some sort of user identifier (name, account number, serial number) and password. Authentication - Who am I, and how can I prove it?Īuthentication is a precursor to some of the other aspects, for reasons that we’ll see in detail as we look at the others. Today I’m going to talk about the first of those: 1. In the first post in this series, I introduced a list of six interrelated things that together form the general topic of “security” in computer systems.
0 kommentar(er)
